Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running Cisco ASA5520's with PIXOS 8.2(1). I have my vpn setup to authenticate users from my ldap server. I need to be able to limit them to a specific group. My login base dn is "dc=example,dc=com" Users are in dn of "uid=$username,ou=users,dc=example,dc=com"

I need to limit vpn access to people are are members in a group in a different OU. The OU I need to check is "gid=vpn,ou=groups,dc=example,dc=com"

Any ideas how I can do that?

share|improve this question
I'm looking at using Reverse Group Membership's to see if that will allow me to be able to better manage this. According to the documentaion That could do what I need. – Squidly Apr 22 '11 at 16:34
Are you using Active Directory, or a different LDAP server? – Nic Nov 10 '11 at 9:00
I'm not using AD. Its an OpenLdap server. I did Figure it out. I'm doing a write up so I can answer the question for others. – Squidly Nov 11 '11 at 1:26

For our ASA, even though we have AD/LDAP, we still use RADIUS. You may find this works beter. I know that doesn't answer your question though.

With that being said, have you seen this article? Looks pretty striaght forward.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.